# Day 12: Life of a Packet # Life of a Packet ## Overview What is the "Life of a Packet"? The life of a packet traces the complete journey of a single packet as it travels from source to destination across multiple networks, through switches and routers, with different headers being applied and modified at each stage. Core Principle: A packet passes through many network devices and may traverse multiple networks. As it travels: - IP addresses (Layer 3) NEVER change — they identify the source and destination hosts - MAC addresses (Layer 2) CHANGE at every hop — they identify the current sender and next receiver This distinction is critical for understanding how networks actually work. --- ## The Big Picture: Layer 3 vs Layer 2 ### IP Addresses (Layer 3) — End-to-End IP addresses remain CONSTANT throughout the packet's journey. SOURCE IP: 192.168.1.100 DESTINATION IP: 192.168.2.100 # These never change, no matter how many routers the packet passes through. They identify the ultimate SOURCE and DESTINATION hosts. # Purpose: Tell routers where the packet needs to go (the final destination) Used by: Routers to make forwarding decisions ### MAC Addresses (Layer 2) — Hop-by-Hop MAC addresses CHANGE at every hop — new source and destination at each step. Each interface on a network device (router, switch) has its OWN MAC address. As a packet travels, different interfaces add their own MAC addresses. # Hop 1: Source MAC = PC's NIC, Destination MAC = Router's G0/0 interface Hop 2: Source MAC = Router's G0/1 interface, Destination MAC = Next Router's interface Hop 3: Source MAC = Next Router's interface, Destination MAC = Destination host's NIC # Purpose: Tell the next device where to send the frame (the immediate next hop) Used by: Switches to forward within LANs, routers to forward between LANs ### Why This Matters Analogy: Sending a letter through the mail # IP Address = Your home address + recipient's home address (Written on the envelope, never changes) MAC Address = Current postal worker + Next postal facility (Changes at each facility — each worker adds/removes their stamp) # --- ## Packet Structure Review ### Layers of Encapsulation ┌─────────────────────────────────────┐ │ Application Data (HTTP, etc) │ ├─────────────────────────────────────┤ │ TCP/UDP Header (Source Port, │ │ Destination Port, Sequence, etc) │ ← Layer 4 PDU ├─────────────────────────────────────┤ │ IPv4 Header (Source IP, │ │ Destination IP, TTL, Protocol) │ ← Layer 3 PDU / IP Packet ├─────────────────────────────────────┤ │ Ethernet Header (Dest MAC, │ │ Source MAC, Type) │ ← Layer 2 PDU / Ethernet Frame │ Ethernet Trailer (FCS) │ └─────────────────────────────────────┘ # ### Field Order Matters! Critical observation: The fields appear in a specific order In TCP Header: \[Source IP\] \[Destination IP\] \[Source Port\] \[Destination Port\] ↑ ↑ Source comes FIRST # In Ethernet Header: \[Destination MAC\] \[Source MAC\] \[Type\] ↑ ↑ Destination comes FIRST (opposite of Layer 3!) # This is important because it shows the different perspectives: - Layer 3 focuses on the ultimate destination (where are we going?) - Layer 2 focuses on the immediate next hop (who am I sending to right now?) --- ## Detailed Journey: Packet Travels Through Network ### Scenario Setup \[Router B\] 10.0.0.2 | WAN Link | PC A ─\[Switch\]─ \[Router A\] ─────────── \[Switch\] ─── PC B 192.168.1.100 10.0.0.1 192.168.2.100 10.0.0.2 # Network A: \- PC A: IP 192.168.1.100, MAC AAAA.AAAA.AAAA \- Router A G0/0: IP 192.168.1.1, MAC 1111.1111.1111 \- Router A G0/1: IP 10.0.0.1, MAC 2222.2222.2222 # WAN Link: \- Router B G0/0: IP 10.0.0.2, MAC 3333.3333.3333 # Network B: \- Router B G0/1: IP 192.168.2.1, MAC 4444.4444.4444 \- PC B: IP 192.168.2.100, MAC BBBB.BBBB.BBBB # Task: PC A sends HTTP packet to PC B --- ## Step-by-Step Packet Journey ### Step 1: PC A Creates the Packet PC A (192.168.1.100) initiates an HTTP request to PC B (192.168.2.100) First, PC A checks if 192.168.2.100 is on the same network: PC A's IP: 192.168.1.100/24 Network: 192.168.1.0/24 (host 100 is in this network) # Destination: 192.168.2.100/24 Network: 192.168.2.0/24 (different network!) # Conclusion: 192.168.2.100 is NOT on my local network Action: Send to default gateway (router) # PC A needs Router A's MAC address (192.168.1.1) PC A sends ARP REQUEST: "Who has 192.168.1.1? Tell 192.168.1.100" Router A responds with ARP REPLY: "I have 192.168.1.1. My MAC is 1111.1111.1111" PC A learns: Router A's MAC = 1111.1111.1111 # PC A creates the packet: ┌─────────────────────────────────────────┐ │ Application Data (HTTP Request) │ ├─────────────────────────────────────────┤ │ TCP Header │ │ Source Port: 50000 │ │ Destination Port: 80 │ ├─────────────────────────────────────────┤ │ IPv4 Header │ │ Source IP: 192.168.1.100 ← CONSTANT │ Destination IP: 192.168.2.100 ← CONSTANT │ TTL: 64 ← Will decrement ├─────────────────────────────────────────┤ │ Ethernet Header │ │ Destination MAC: 1111.1111.1111 ← Router A │ Source MAC: AAAA.AAAA.AAAA ← PC A │ Type: 0x0800 (IPv4) │ ├─────────────────────────────────────────┤ │ Ethernet Trailer (FCS) │ └─────────────────────────────────────────┘ # Key Point: IP addresses are already set — they will NOT change during transit! --- ### Step 2: Packet Travels on Network A (Local LAN) PC A sends the frame out on the Ethernet to all devices on the switch Switch processing: Switch receives frame on port with PC A ↓ Examines Destination MAC: 1111.1111.1111 ↓ Looks in MAC address table: "Where is 1111.1111.1111?" ↓ MAC table shows: 1111.1111.1111 is on port connected to Router A ↓ Action: Forward frame out that port only (known unicast) # Router A receives the frame on interface G0/0 Router A receives frame on G0/0 ↓ Examines Ethernet Destination MAC: 1111.1111.1111 ↓ Checks local interfaces: "Is this MY MAC? Yes!" ↓ Action: Strip Ethernet header/trailer, examine IPv4 header # --- ### Step 3: Router A Processes the Packet Router A examines the IPv4 header: Source IP: 192.168.1.100 Destination IP: 192.168.2.100 TTL: 64 # Router A's routing table lookup: "Destination 192.168.2.100... which network? 192.168.2.0/24" "Where is 192.168.2.0/24? Via next-hop 10.0.0.2" "That's Router B at 10.0.0.2" Action: Forward out interface G0/1 toward Router B # Router A decrements TTL: Original TTL: 64 Decremented: 64 - 1 = 63 New TTL: 63 # Router A creates NEW Ethernet header: This is CRITICAL: The Ethernet header is REPLACED! # Old Ethernet Header (from Network A): Destination MAC: 1111.1111.1111 (Router A's G0/0) Source MAC: AAAA.AAAA.AAAA (PC A's NIC) # New Ethernet Header (for WAN Link): Destination MAC: 3333.3333.3333 ← Router B's G0/0 Source MAC: 2222.2222.2222 ← Router A's G0/1 Type: 0x0800 (IPv4) # IPv4 Header (UNCHANGED): Source IP: 192.168.1.100 ← STILL THE SAME Destination IP: 192.168.2.100 ← STILL THE SAME TTL: 63 ← Decremented # Visualization of what happened: Before Router A processing: ┌─────────────────────────┐ │ Application Data (HTTP) │ ├─────────────────────────┤ │ TCP Header │ ├─────────────────────────┤ │ IPv4 Header │ │ Src: 192.168.1.100 │ │ Dst: 192.168.2.100 │ │ TTL: 64 │ ├─────────────────────────┤ │ Eth Header (OLD) │ │ Dst MAC: 1111.1111.1111 │ │ Src MAC: AAAA.AAAA.AAAA │ └─────────────────────────┘ # After Router A processing: ┌─────────────────────────┐ │ Application Data (HTTP) │ ├─────────────────────────┤ │ TCP Header │ ├─────────────────────────┤ │ IPv4 Header │ │ Src: 192.168.1.100 ✓ │ │ Dst: 192.168.2.100 ✓ │ │ TTL: 63 │ ├─────────────────────────┤ │ Eth Header (NEW) │ │ Dst MAC: 3333.3333.3333 │ │ Src MAC: 2222.2222.2222 │ └─────────────────────────┘ # --- ### Step 4: Packet Travels on WAN Link Router A sends the new frame toward Router B Router B receives the frame on interface G0/0 Router B receives frame on G0/0 ↓ Examines Ethernet Destination MAC: 3333.3333.3333 ↓ Checks local interfaces: "Is this MY MAC? Yes!" ↓ Action: Strip Ethernet header/trailer, examine IPv4 header # --- ### Step 5: Router B Processes the Packet Router B examines the IPv4 header: Source IP: 192.168.1.100 ← Still PC A! Destination IP: 192.168.2.100 ← Still PC B! TTL: 63 # Router B's routing table lookup: "Destination 192.168.2.100... which network? 192.168.2.0/24" "Is 192.168.2.0/24 directly connected to me? Yes! On G0/1" Action: Forward directly out interface G0/1 # Router B decrements TTL: Original TTL: 63 Decremented: 63 - 1 = 62 New TTL: 62 # Router B creates NEW Ethernet header: This time, destination is directly connected: # Old Ethernet Header (from WAN): Destination MAC: 3333.3333.3333 (Router B's G0/0) Source MAC: 2222.2222.2222 (Router A's G0/1) # Router B needs PC B's MAC address: Sends ARP REQUEST: "Who has 192.168.2.100? Tell me" PC B responds: "I have 192.168.2.100. My MAC is BBBB.BBBB.BBBB" Router B learns: PC B's MAC = BBBB.BBBB.BBBB # New Ethernet Header (for Network B): Destination MAC: BBBB.BBBB.BBBB ← PC B's NIC Source MAC: 4444.4444.4444 ← Router B's G0/1 Type: 0x0800 (IPv4) # IPv4 Header (UNCHANGED): Source IP: 192.168.1.100 ← STILL THE SAME Destination IP: 192.168.2.100 ← STILL THE SAME TTL: 62 ← Decremented again # --- ### Step 6: Packet Travels on Network B (Local LAN) Router B sends the frame out on the Ethernet to switch on Network B Switch processes: Switch receives frame on port with Router B ↓ Examines Destination MAC: BBBB.BBBB.BBBB ↓ Looks in MAC address table: "Where is BBBB.BBBB.BBBB?" ↓ MAC table shows: BBBB.BBBB.BBBB is on port connected to PC B ↓ Action: Forward frame out that port only # PC B receives the frame PC B's NIC receives frame ↓ Examines Ethernet Destination MAC: BBBB.BBBB.BBBB ↓ Checks: "Is this MY MAC? Yes!" ↓ Action: Accept frame, strip Ethernet header/trailer ↓ Examine IPv4 header # --- ### Step 7: PC B Processes the Packet PC B examines the IPv4 header: Source IP: 192.168.1.100 ← Where did this come from Destination IP: 192.168.2.100 ← This is MY IP TTL: 62 # Router processing: "Is this packet destined for ME? Yes!" Action: Don't forward, hand to Layer 4 (TCP) # PC B examines the TCP header: Source Port: 50000 (from PC A) Destination Port: 80 (HTTP) # TCP processing: "Is port 80 open? Yes, web server is listening" Action: Pass to HTTP application (web browser or server) # PC B's HTTP application receives the data Application layer processes the HTTP request Web server generates HTTP response Response is sent back toward PC A (reverse journey) # --- ## Summary: MAC Addresses vs IP Addresses ### What Changed / What Stayed the Same PC A Router A Router B PC B ↓ ↓ ↓ ↓ # Ethernet Header: Dest MAC AAAA→1111 AAAA→3333 3333→BBBB Src MAC AAAA←AAAA 2222←2222 4444←4444 ↓↓ ↓↓ ↓↓ CHANGED CHANGED CHANGED at each hop # IPv4 Header: Src IP 192.168.1.100 → 192.168.1.100 → 192.168.1.100 → 192.168.1.100 ↓↓ NEVER CHANGES - Identifies ultimate source # Dst IP 192.168.2.100 → 192.168.2.100 → 192.168.2.100 → 192.168.2.100 ↓↓ NEVER CHANGES - Identifies ultimate destination # TTL 64 → 63 → 62 → 61 ↓↓ ↓↓ DECREMENTED at each router hop # --- ## Key Concepts: Why MAC Changes, IP Doesn't ### IP Addresses: End-to-End Navigation IP addresses define the final destination: "I am PC A (192.168.1.100) and I want to send this to PC B (192.168.2.100)" # This information MUST be in every packet so that: 1\. Routers know the ultimate destination 2\. The destination knows it was for them 3\. Response packets can find the way back # Changing IP addresses would mean: \- Routers wouldn't know where to send it \- Destination wouldn't know who to respond to # ### MAC Addresses: Local Hop Navigation MAC addresses define the CURRENT hop: "Right now, send this to the interface that's my next hop" # At each hop: \- Router A says: "Send to Router B at 10.0.0.2 (MAC: 3333.3333.3333)" \- Router B says: "Send to PC B at 192.168.2.100 (MAC: BBBB.BBBB.BBBB)" # Changing MAC addresses at each hop means: \- Devices know which interface to send the frame to immediately \- Each interface in a router gets its own MAC address \- The destination MAC changes based on the next hop # ### Analogy: Package Delivery Package Contents: From: 123 Main St (IP address) ← Never changes To: 456 Oak Ave (IP address) ← Never changes # Delivery Process: Postman A: "Take to Postal Hub B" (MAC address) Hub B Postman: "Take to Postal Hub C" (MAC address) Hub C Postman: "Take to 456 Oak Ave" (MAC address) Each postman (router) has different address (MAC) for next hop But the package's original and final addresses never change # --- ## Packet Journey with Port Numbers ### Understanding Port Numbers (Layer 4) Port numbers also remain constant throughout the journey. Source Port: 50000 (from PC A - random ephemeral port) Destination Port: 80 (HTTP service on PC B) # These identify the specific application/service: \- Port 80 = HTTP web server \- Port 443 = HTTPS web server \- Port 22 = SSH \- Port 23 = Telnet \- Ports 49152-65535 = Ephemeral (temporary, assigned by OS) # ### Why Ports Don't Change Like IP addresses, port numbers identify the endpoint services. If routers changed port numbers, the destination wouldn't know which service the packet was meant for. # Routers don't care about port numbers (they're Layer 4). Routers only care about: \- Layer 3: Destination IP (where to forward) \- Layer 2: Destination MAC (which interface to use) # --- ## TTL and the Journey ### TTL Decrements at Each Router PC A sends with TTL = 64 # Router A: Receives TTL = 64 Decrements: 64 - 1 = 63 Forwards with TTL = 63 # Router B: Receives TTL = 63 Decrements: 63 - 1 = 62 Forwards with TTL = 62 # PC B: Receives with TTL = 62 (Doesn't decrement - destination doesn't forward) # ### Why TTL Matters Prevents infinite loops: If routing loop exists (Router A → Router B → Router A): TTL = 64 at Router A TTL = 63 after Router B TTL = 62 at Router A again TTL = 61 after Router B ... continues ... TTL = 1 at Router A TTL = 0 after Router B → DROPPED # Packet never circulates infinitely, consuming bandwidth # --- ## Complete Packet at Each Stage ### Stage 1: PC A Creates (Network A) Ethernet Header: ├─ Dest MAC: 1111.1111.1111 (Router A G0/0) ├─ Src MAC: AAAA.AAAA.AAAA (PC A) └─ Type: 0x0800 # IPv4 Header: ├─ Src IP: 192.168.1.100 ├─ Dst IP: 192.168.2.100 ├─ TTL: 64 └─ Protocol: 6 (TCP) # TCP Header: ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: \[value\] └─ Flags: \[SYN\] # HTTP Data: "GET / HTTP/1.1..." # ### Stage 2: Router A Forwards (WAN) Ethernet Header: ├─ Dest MAC: 3333.3333.3333 (Router B G0/0) ← CHANGED ├─ Src MAC: 2222.2222.2222 (Router A G0/1) ← CHANGED └─ Type: 0x0800 # IPv4 Header: ├─ Src IP: 192.168.1.100 ← SAME ├─ Dst IP: 192.168.2.100 ← SAME ├─ TTL: 63 ← DECREMENTED └─ Protocol: 6 (TCP) ← SAME # TCP Header: (UNCHANGED) ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: \[value\] └─ Flags: \[SYN\] # HTTP Data: (UNCHANGED) "GET / HTTP/1.1..." # ### Stage 3: Router B Forwards (Network B) Ethernet Header: ├─ Dest MAC: BBBB.BBBB.BBBB (PC B) ← CHANGED ├─ Src MAC: 4444.4444.4444 (Router B G0/1) ← CHANGED └─ Type: 0x0800 # IPv4 Header: ├─ Src IP: 192.168.1.100 ← SAME ├─ Dst IP: 192.168.2.100 ← SAME ├─ TTL: 62 ← DECREMENTED └─ Protocol: 6 (TCP) ← SAME # TCP Header: (UNCHANGED) ├─ Src Port: 50000 ├─ Dst Port: 80 ├─ Sequence: \[value\] └─ Flags: \[SYN\] # HTTP Data: (UNCHANGED) "GET / HTTP/1.1..." # ### Stage 4: PC B Receives Ethernet Header: (Stripped off) # IPv4 Header: (Examined and passed to TCP) ├─ Src IP: 192.168.1.100 ← Identifies who sent it ├─ Dst IP: 192.168.2.100 ← "This is for me!" ├─ TTL: 62 └─ Protocol: 6 (TCP) ← "Pass to TCP handler" # TCP Header: (Examined and passed to HTTP) ├─ Src Port: 50000 ← "From where?" ├─ Dst Port: 80 ← "To HTTP service" ├─ Sequence: \[value\] └─ Flags: \[SYN\] ← "Connection attempt" # HTTP Application: (Processes request) "GET / HTTP/1.1 from PC A... Generate response" # --- ## Key Takeaways for CCNA ✅ IP addresses NEVER change during transit — they identify source and destination hosts ✅ MAC addresses CHANGE at every hop — they identify the current sender and next receiver ✅ Each router interface has a unique MAC address for its local network segment ✅ Routers decrement TTL by 1 at each hop to prevent infinite loops ✅ Ethernet destination MAC comes BEFORE source MAC in the header (opposite of Layer 3) ✅ Port numbers stay constant throughout the journey (identify services/applications) ✅ Routers use destination IP to determine where to forward packets ✅ Routers need destination MAC to know which interface to send the frame to ✅ If destination not directly connected, router uses next-hop IP (from routing table) to determine destination MAC ✅ Switches use destination MAC to forward frames within LANs; routers replace MAC at each hop ✅ Packet encapsulation remains as it travels — each layer's header is examined then passed down/up ✅ Return packets follow reverse path but go through same address transformations (MAC changes, IP stays same) ✅ ARP resolves IP addresses to MAC addresses when router needs to forward to next hop or final destination ✅ TTL reaching 0 causes packet to be dropped (prevents routing loop packet storms) ✅ Each device on path adds only its own MAC as source — never "hops" across multiple devices in one frame